If the ndebit were to become compromised, it's only affiliated with the node, which can be discarded and replaced with another, but the nsec npub is still intact.